We are not allowed to use attraccessible in Rails 4 anymore, now the way to get parameters from our create and update forms is through ** strongparams **.

// In the Restaurant model
class Restaurant < ActiveRecord::Base
    has_and_belongs_to_many :cuisines
end

// In the restaurant_controller
def restaurant_params
  params[:restaurant].permit(
    :name,
    :address,
    :phone,
    {:cuisine_ids => []}
  ),
end

This way when we call params to our restaurant create and update methods we pass them the restaurant_params function.

Rails automatically handles the insert and update of our related models, in this case Cuisine if we pass a cuisine_ids array containing the ids of the Cuisine instances.

Using strongparameters we need to define that cuisineids is an array.

{ 
    :cuisine_ids => [] 
}

References

Strong Parameters on Github

RailsCasts #17 HABTM Checkboxes